diff --git a/.prototools b/.prototools
index c382ebb..c1847ba 100644
--- a/.prototools
+++ b/.prototools
@@ -12,6 +12,7 @@ flux = "2.8.8"
 flux-operator-mcp = "0.52.0"
 golangci-lint = "2.12.2"
 grpcurl = "1.9.3"
+helm = "4.2.3"
 kind = "0.32.0"
 kubeconform = "0.8.0"
 prek = "0.4.5"
@@ -41,6 +42,7 @@ flux = "file://./flux/plugin.toml"
 flux-operator-mcp = "file://./flux-operator-mcp/plugin.toml"
 golangci-lint = "file://./golangci-lint/plugin.toml"
 grpcurl = "file://./grpcurl/plugin.toml"
+helm = "file://./helm/plugin.toml"
 kind = "file://./kind/plugin.toml"
 kubeconform = "file://./kubeconform/plugin.toml"
 prek = "file://./prek/plugin.toml"
diff --git a/helm/README.md b/helm/README.md
new file mode 100644
index 0000000..91d1493
--- /dev/null
+++ b/helm/README.md
@@ -0,0 +1,19 @@
+# helm plugin
+
+[helm](https://helm.sh) plugin for [proto](https://github.com/moonrepo/proto).
+
+## Installation
+
+helm is not built into proto, so register this plugin, pin a version, then install:
+
+```shell
+proto plugin add helm "https://raw.githubusercontent.com/Genesis-Embodied-AI/proto-plugins/main/helm/plugin.toml"
+proto pin helm latest --resolve
+proto install helm
+```
+
+## Notes
+
+Binaries come from <https://get.helm.sh>, not the GitHub release assets, and each archive
+nests the binary under an `<os>-<arch>/` directory. Releases are listed at
+<https://github.com/helm/helm/releases>.
diff --git a/helm/plugin.toml b/helm/plugin.toml
new file mode 100644
index 0000000..f10dc56
--- /dev/null
+++ b/helm/plugin.toml
@@ -0,0 +1,37 @@
+name = "helm"
+type = "cli"
+
+[resolve]
+git-url = "https://github.com/helm/helm"
+# Helm tags release candidates (v4.0.0-rc.1), so anchor on bare semver to keep
+# `latest --resolve` on stable releases.
+version-pattern = "^v((?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+))$"
+
+[install.arch]
+aarch64 = "arm64"
+x86_64 = "amd64"
+
+# Helm publishes its binaries to get.helm.sh instead of attaching them to the
+# GitHub release, so the download URLs do not follow the repository. Each
+# archive nests the binary under an <os>-<arch>/ directory.
+[platform.linux]
+archive-prefix = "linux-{arch}"
+download-file = "helm-v{version}-linux-{arch}.tar.gz"
+checksum-file = "helm-v{version}-linux-{arch}.tar.gz.sha256sum"
+exe-path = "helm"
+
+[platform.macos]
+archive-prefix = "darwin-{arch}"
+download-file = "helm-v{version}-darwin-{arch}.tar.gz"
+checksum-file = "helm-v{version}-darwin-{arch}.tar.gz.sha256sum"
+exe-path = "helm"
+
+[platform.windows]
+archive-prefix = "windows-{arch}"
+download-file = "helm-v{version}-windows-{arch}.zip"
+checksum-file = "helm-v{version}-windows-{arch}.zip.sha256sum"
+exe-path = "helm.exe"
+
+[install]
+download-url = "https://get.helm.sh/{download_file}"
+checksum-url = "https://get.helm.sh/{checksum_file}"